Creative Content

23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:T733,"is-C43EB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Patch.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "is-1OK2O.tmp" has type "XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators" "is-4ADUE.tmp" has type "XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators" "is-V7SHA.tmp" has type "HTML document ASCII text with CRLF line terminators" "is-8IBM2.tmp" has type "HTML document UTF-8 Unicode (with BOM) text with CRLF line terminators" "is-7EQKP.tmp" has type "HTML document UTF-8 Unicode (with BOM) text with very long lines with CRLF line terminators" "is-G6MV5.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "is-IHLUL.tmp" has type "XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators" "is-AGM7O.tmp" has type "XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators" "is-0R9E5.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "is-H1EGB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "is-39R88.tmp" has type "HTML document UTF-8 Unicode (with BOM) text with CRLF line terminators" "is-B03HI.tmp" has type "ASCII text with CRLF line terminators" "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows" "is-71NQG.tmp" has type "XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators" "is-JPJVM.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-32UVC.tmp" has type "HTML document UTF-8 Unicode (with BOM) text with very long lines with CRLF line terminators" "is-96QFH.tmp" has type "HTML document UTF-8 Unicode (with BOM) text with CRLF line terminators" "is-BJTEQ.tmp" has type "HTML document UTF-8 Unicode (with BOM) text with CRLF line terminators"25:T4ce,"Patch.exe" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui" "Patch.exe" touched file "C:\Windows\syswow64\en\KERNELBASE.dll.mui" "Patch.exe" touched file "C:\Windows\SysWOW64\netmsg.dll" "Patch.tmp" touched file "C:\Windows\Fonts\StaticCache.dat" "Patch.tmp" touched file "C:\Windows\SysWOW64\en-US\user32.dll.mui" "Patch.tmp" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "Patch.tmp" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui" "Patch.tmp" touched file "C:\Windows\syswow64\en\KERNELBASE.dll.mui" "Patch.tmp" touched file "C:\Windows\SysWOW64\netmsg.dll" "Patch.tmp" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui" "1.exe" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui" "1.exe" touched file "C:\Windows\syswow64\en\KERNELBASE.dll.mui" "1.exe" touched file "C:\Windows\SysWOW64\netmsg.dll" "1.tmp" touched file "C:\Windows\Fonts\StaticCache.dat" "1.tmp" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui" "1.tmp" touched file "C:\Windows\SysWOW64\imageres.dll" "1.tmp" touched file "C:\Windows\SysWOW64\shell32.dll" "1.tmp" touched file "C:\Windows\SysWOW64\en-US\shell32.dll.mui" "1.tmp" touched file "C:\Windows\syswow64\en\shell32.dll.mui"26:T83e,Pattern match: "http://schemas.microsoft.com/SMI/2" Heuristic match: "Font.Name" Pattern match: "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://www.kymoto.org" Heuristic match: "COMMAND.COM" Pattern match: "http://www.innosetup.com/" Pattern match: "http://www.remobjects.com/ps" Pattern match: "http://www.haysoft.org" Pattern match: "http://www" Pattern match: "alkornel.hu/innosetup" Pattern match: "https://dl25.nero.com/software/other/VideoTemplate+theme.thumbnailfile.replace" Pattern match: "http://ftp20.us.nero.com/software/other/VideoTemplate+theme.thumbnailfile.replace" Pattern match: "http://www.nero.com/redir.php?id=13345&x-source=software.{!--Region::2--}.{!--Lang3--}.launch" Pattern match: "https://i2am.nero.com/deu/i2am/nero-2019/test-subscription/advertis-left.php" Pattern match: "http://forum.nero.com/nero_eng" Pattern match: "http://forum.nero.de/nero" Heuristic match: "window.authentication.tel = data.result.tel" Pattern match: "http://localhost:3000" Pattern match: "http://www.nero.com/" Pattern match: "https://www.nero.com/download.php?id=nplasub" Pattern match: "https://www.nero.com/download/365" Pattern match: "http://www.nero.com/download.php?id=nplasub" Pattern match: "https://www.nero.com/download/unlimited" Pattern match: "http://www.nero.com/download.php?id=n2020pla" Pattern match: "www.nero.com" Pattern match: "http://www.nero.com/redir.php?id=${id" Pattern match: "http://www.nero.com/redir.php?id=14047" Pattern match: "http://www.nero.com/redir.php?id=14086" Pattern match: "http://www.nero.com/redir.php?id=14370','_blank" Pattern match: "http://www.nero.com/redir.php?id=14369','_blank" Pattern match: "https://www.amazon.de/gp/product/B07NZXBSX7/ref=as_li_tl?ie=UTF8&camp=1638&creative=6742&creativeASIN=B07NZXBSX7&linkCode=as2&tag=nesfhd-21&linkId=9d49ce634be0eda1a74795821d7468f8" Heuristic match: "let noString = this.no" Heuristic match: "if(this.products && this.products.length) this.id = this.products[0].id" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings"27:T43d,RegCloseKey OpenProcessToken RegOpenKeyExW GetModuleFileNameW GetVersionExW VirtualProtect GetFileAttributesW GetFileSize LockResource GetCommandLineW UnhandledExceptionFilter LoadLibraryExW CreateDirectoryW DeleteFileW GetProcAddress LoadLibraryW WriteFile GetStartupInfoA FindFirstFileW GetModuleHandleW FindResourceW CreateFileW CreateProcessW Sleep GetTickCount VirtualAlloc RegCreateKeyExW RegOpenKeyW RegOpenKeyExA IsDebuggerPresent GetModuleFileNameA LoadLibraryA LoadLibraryExA WriteProcessMemory MapViewOfFile GetTempFileNameW CreateFileMappingW CreateThread OpenFileMappingW TerminateProcess OutputDebugStringW ShellExecuteExW RegDeleteKeyW SetSecurityDescriptorDacl GetUserNameW RegEnumKeyExW RegDeleteValueW GetDriveTypeW DeviceIoControl CopyFileW ExitThread OpenProcess GetComputerNameW FindNextFileW ShellExecuteW GetCursorPos SetWindowsHookExW GetLastActivePopup FindWindowExW FindWindowW GetWindowThreadProcessId GetTempPathW GetStartupInfoW WinExec CreateFileMoniker GetModuleHandleA OutputDebugStringA28:T450,"Patch.exe" wrote bytes "711193007a3b9200ab8b02007f950200fc8c0200729602006cc805001ecd8f007d268f00" to virtual address "0x772007E4" (part of module "USER32.DLL") "Patch.tmp" wrote bytes "711193007a3b9200ab8b02007f950200fc8c0200729602006cc805001ecd8f007d268f00" to virtual address "0x772007E4" (part of module "USER32.DLL") "Patch.tmp" wrote bytes "f8116c7520146c754cbc6e75f5166c75a9116c7585486c75b9346c75a9346c7568346c7500000000a56ba175e485a175e04da1759cc0a175a3bfa17592aea1750c7da17500000000" to virtual address "0x74151000" (part of module "MSIMG32.DLL") "1.exe" wrote bytes "711193007a3b9200ab8b02007f950200fc8c0200729602006cc805001ecd8f007d268f00" to virtual address "0x772007E4" (part of module "USER32.DLL") "1.tmp" wrote bytes "711193007a3b9200ab8b02007f950200fc8c0200729602006cc805001ecd8f007d268f00" to virtual address "0x772007E4" (part of module "USER32.DLL") "1.tmp" wrote bytes "f8116c7520146c754cbc6e75f5166c75a9116c7585486c75b9346c75a9346c7568346c7500000000a56ba175e485a175e04da1759cc0a175a3bfa17592aea1750c7da17500000000" to virtual address "0x74151000" (part of module "MSIMG32.DLL")29:T48d,Attempt to find devices in networks: "169.254.11.225/32, 169.254.12.152/32, 169.254.40.52/32, 169.254.100.12/32, 169.254.100.82/32, 169.254.112.179/32, 169.254.125.224/32, 169.254.140.111/32, 169.254.144.235/32, 169.254.164.83/32, 169.254.186.224/32, 169.254.216.24/32, 169.254.243.229/32, 169.254.255.91/32, 192.168.240.1/32, 192.168.240.2/32, 192.168.240.142/32, 192.168.241.37/32, 192.168.241.120/32, 192.168.241.122/32, 192.168.241.125/32, 192.168.241.145/32, 192.168.241.163/32, 192.168.241.166/32, 192.168.241.180/32, 192.168.241.230/32, 192.168.241.242/32, 192.168.241.250/32, 192.168.242.0/32, 192.168.242.7/32, 192.168.242.21/32, 192.168.242.49/32, 192.168.242.58/32, 192.168.242.71/32, 192.168.242.80/31, 192.168.242.88/32, 192.168.242.112/31, 192.168.242.125/32, 192.168.242.128/31, 192.168.242.144/32, 192.168.242.155/32, 192.168.242.166/32, 192.168.242.185/32, 192.168.242.196/32, 192.168.242.218/31, 192.168.242.251/32, 192.168.243.0/32, 192.168.243.26/32, 192.168.243.42/32, 192.168.243.45/32, 192.168.243.47/32, 192.168.243.77/32, 192.168.243.93/32, 192.168.243.128/32, 192.168.243.153/32, 192.168.243.178/32, 192.168.243.187/32, 192.168.243.212/32"2a:T41e,"Patch.exe" called "FindResourceW" with parameter "11111" - (UID: 00000000-00002556) "Patch.tmp" called "FindResourceW" with parameter "23105788" - (UID: 00000000-00002968) "Patch.tmp" called "FindResourceW" with parameter "23072852" - (UID: 00000000-00002968) "Patch.tmp" called "FindResourceW" with parameter "19" - (UID: 00000000-00002968) "Patch.tmp" called "FindResourceW" with parameter "40" - (UID: 00000000-00002968) "Patch.tmp" called "FindResourceW" (UID: 00000000-00002968) "Patch.tmp" called "FindResourceW" with parameter "23105884" - (UID: 00000000-00002968) "Patch.tmp" called "FindResourceW" with parameter "23073092" - (UID: 00000000-00002968) "Patch.tmp" called "FindResourceW" with parameter "3" - (UID: 00000000-00002968) "1.tmp" called "FindResourceW" (UID: 00000000-00001952) "1.tmp" called "FindResourceW" with parameter "3" - (UID: 00000000-00001952) "1.tmp" called "FindResourceW" with parameter "23490124" - (UID: 00000000-00001952) "1.tmp" called "FindResourceW" with parameter "23461388" - (UID: 00000000-00001952)2b:T54a,GetTickCount@KERNEL32.DLL at 00000000-00002556-21792-643-004030BC GetTickCount@KERNEL32.DLL at 00000000-00002968-30432-4864-004E6308 GetTickCount@KERNEL32.DLL at 00000000-00002968-30432-4804-004D85EC GetTickCount@KERNEL32.DLL at 00000000-00002968-30432-1365-00480EA4 GetTickCount@KERNEL32.DLL at 00000000-00002968-30432-1172-004B3678 GetTickCount@KERNEL32.DLL at 00000000-00002968-30432-3617-00448F68 GetTickCount@KERNEL32.DLL at 00000000-00002968-30432-4072-0046A734 GetTickCount@KERNEL32.DLL at 00000000-00002968-30432-1125-004032D4 GetTickCount@KERNEL32.DLL at 00000000-00002968-30432-3580-00445060 GetTickCount@KERNEL32.DLL at 00000000-00002968-30432-125-004DEAEC GetTickCount@KERNEL32.DLL at 00000000-00002968-30432-3935-004655D8 GetTickCount@KERNEL32.DLL at 00000000-00003560-30432-1363-00480EBC GetTickCount@KERNEL32.DLL at 00000000-00003560-30432-4114-004715B8 GetTickCount@KERNEL32.DLL at 00000000-00003560-30369-642-004030BC GetTickCount@KERNEL32.DLL at 00000000-00001952-36757-3617-00448F68 GetTickCount@KERNEL32.DLL at 00000000-00001952-36757-125-004DEAEC GetTickCount@KERNEL32.DLL at 00000000-00001952-36757-1125-004032D4 GetTickCount@KERNEL32.DLL at 00000000-00001952-36757-3580-00445060 GetTickCount@KERNEL32.DLL at 00000000-00001952-36757-1363-00480EBC GetTickCount@KERNEL32.DLL at 00000000-00001952-36757-1365-00480EA42c:T562,FindFirstFileW@KERNEL32.DLL at 00000000-00002556-21792-68-00405BEC FindNextFileW@KERNEL32.DLL at 00000000-00002968-30432-1341-004E2074 FindNextFileW@KERNEL32.DLL at 00000000-00002968-30432-1419-004D1578 FindFirstFileW@KERNEL32.DLL at 00000000-00002968-30432-4743-004C107C FindFirstFileW@KERNEL32.DLL at 00000000-00002968-30432-141-004AD294 FindNextFileW@KERNEL32.DLL at 00000000-00002968-30432-4772-004DF4CC FindFirstFileW@KERNEL32.DLL at 00000000-00002968-30432-4843-004D4F34 FindFirstFileW@KERNEL32.DLL at 00000000-00002968-30432-73-00408174 FindFirstFileW@KERNEL32.DLL at 00000000-00003560-30432-4709-004BF43C FindFirstFileW@KERNEL32.DLL at 00000000-00003560-30432-4735-004C0BC0 FindNextFileW@KERNEL32.DLL at 00000000-00003560-30432-4566-004AECF0 FindFirstFileW@KERNEL32.DLL at 00000000-00003560-30369-68-00405BEC FindFirstFileW@KERNEL32.DLL at 00000000-00003560-30432-1159-004FDF38 FindNextFileW@KERNEL32.DLL at 00000000-00003560-30432-127-004AEA0C FindFirstFileW@KERNEL32.DLL at 00000000-00001952-36757-73-00408174 FindNextFileW@KERNEL32.DLL at 00000000-00001952-36757-1341-004E2074 FindNextFileW@KERNEL32.DLL at 00000000-00001952-36757-127-004AEA0C FindFirstFileW@KERNEL32.DLL at 00000000-00001952-36757-141-004AD294 FindNextFileW@KERNEL32.DLL at 00000000-00001952-36757-1419-004D1578 FindFirstFileW@KERNEL32.DLL at 00000000-00001952-36757-1159-004FDF382d:T52a,GetVersionExW@KERNEL32.DLL at 00000000-00002556-21792-147-0040A358 GetVersion@KERNEL32.DLL at 00000000-00002556-21792-154-0040646C GetVersion@KERNEL32.DLL at 00000000-00002556-21792-540-004110C4 GetVersion@KERNEL32.DLL at 00000000-00002556-21792-153-00411000 GetVersion@KERNEL32.DLL at 00000000-00002968-30432-1218-00408DE4 GetVersion@KERNEL32.DLL at 00000000-00002968-30432-4714-004BFA6C GetVersion@KERNEL32.DLL at 00000000-00002968-30432-4547-004AA464 GetVersion@KERNEL32.DLL at 00000000-00002968-30432-1442-004B8A78 GetVersion@KERNEL32.DLL at 00000000-00002968-30432-3663-0044DDFC GetVersion@KERNEL32.DLL at 00000000-00002968-30432-4716-004BFBD4 GetVersionExW@KERNEL32.DLL at 00000000-00003560-30432-4478-004A4E40 GetVersion@KERNEL32.DLL at 00000000-00003560-30432-1091-0047FFEC GetVersion@KERNEL32.DLL at 00000000-00003560-30432-4260-0047F814 GetVersion@KERNEL32.DLL at 00000000-00003560-30432-1319-004CC238 GetVersionExW@KERNEL32.DLL at 00000000-00003560-30432-1213-004124AC GetVersion@KERNEL32.DLL at 00000000-00003560-30369-154-0040646C GetVersion@KERNEL32.DLL at 00000000-00003560-30369-539-004110C4 GetVersionExW@KERNEL32.DLL at 00000000-00003560-30369-147-0040A358 GetVersion@KERNEL32.DLL at 00000000-00003560-30369-153-00411000 GetVersion@KERNEL32.DLL at 00000000-00001952-36757-3663-0044DDFC2e:T450,GetLocaleInfoW@KERNEL32.DLL at 00000000-00002556-21792-130-00408EB4 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002556-21792-531-0040E640 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002556-21792-67-00405DE8 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002556-21792-125-00408F00 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002968-30432-1204-00410FC0 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002968-30432-1203-0041100C GetLocaleInfoW@KERNEL32.DLL at 00000000-00002968-30432-72-00408370 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002968-30432-1106-004B0DAC GetLocaleInfoW@KERNEL32.DLL at 00000000-00003560-30369-130-00408EB4 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003560-30369-530-0040E640 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003560-30369-67-00405DE8 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003560-30369-125-00408F00 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001952-36757-1106-004B0DAC GetLocaleInfoW@KERNEL32.DLL at 00000000-00001952-36757-1203-0041100C GetLocaleInfoW@KERNEL32.DLL at 00000000-00001952-36757-72-00408370 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001952-36757-1204-00410FC02f:Tafe,Found API call GetVersion@KERNEL32.DLL directly followed by "cmp edx, 05h" and "jne 0040648Bh" at 00000000-00002556-21792-154-0040646C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000600h" and "je 0041112Bh" at 00000000-00002556-21792-540-004110C4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp edx, 05h" and "jne 00408E03h" at 00000000-00002968-30432-1218-00408DE4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jnc 004BFADFh" at 00000000-00002968-30432-4714-004BFA6C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 004AA55Bh" at 00000000-00002968-30432-4547-004AA464 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jnc 004B8AAFh" at 00000000-00002968-30432-1442-004B8A78 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 04h" and "jc 0044E01Ch" at 00000000-00002968-30432-3663-0044DDFC Found API call GetDiskFreeSpaceW@KERNEL32.DLL directly followed by "cmp byte ptr [ebp-02h], 00h" and "je 004B0B89h" at 00000000-00002968-30432-4587-004B0A78 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 004BFC4Fh" at 00000000-00002968-30432-4716-004BFBD4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jc 0048006Bh" at 00000000-00003560-30432-1091-0047FFEC Found API call GetKeyboardLayout@USER32.DLL directly followed by "cmp ebx, dword ptr [00503A9Ch]" and "je 00452916h" at 00000000-00003560-30432-3723-004528E8 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 0047F86Fh" at 00000000-00003560-30432-4260-0047F814 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000601h" and "jc 004CC2A7h" at 00000000-00003560-30432-1319-004CC238 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp edx, 05h" and "jne 0040648Bh" at 00000000-00003560-30369-154-0040646C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000600h" and "je 0041112Bh" at 00000000-00003560-30369-539-004110C4 Found API call GetKeyboardLayout@USER32.DLL directly followed by "cmp ebx, dword ptr [00503A9Ch]" and "je 00452916h" at 00000000-00001952-36757-3723-004528E8 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 04h" and "jc 0044E01Ch" at 00000000-00001952-36757-3663-0044DDFC Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000601h" and "jc 004CC2A7h" at 00000000-00001952-36757-1319-004CC238 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jnc 004B8AAFh" at 00000000-00001952-36757-1442-004B8A78 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jc 0048006Bh" at 00000000-00001952-36757-1091-0047FFEC30:T632,"Patch.exe" called "CreateDirectoryW" with parameter C:\Users\qtpRqgc\AppData\Local\Temp\is-TO1IB.tmp (UID: 00000000-00002556) "Patch.tmp" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS (UID: 00000000-00002968) "Patch.tmp" called "CreateDirectoryW" with parameter C:\Users\qtpRqgc\AppData\Local (UID: 00000000-00002968) "Patch.tmp" called "CreateDirectoryW" with parameter C:\Users\qtpRqgc\AppData\Local\Programs (UID: 00000000-00002968) "Patch.tmp" called "CreateDirectoryW" with parameter C:\Users\qtpRqgc\AppData\Local\Programs\Common (UID: 00000000-00002968) "Patch.tmp" called "CreateDirectoryW" (UID: 00000000-00002968) "1.tmp" called "CreateDirectoryW" (UID: 00000000-00001952) "1.tmp" called "CreateDirectoryW" with parameter C:\Users\qtpRqgc\AppData\Local (UID: 00000000-00001952) "1.tmp" called "CreateDirectoryW" with parameter C:\Users\qtpRqgc\AppData\Local\Programs (UID: 00000000-00001952) "1.tmp" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS (UID: 00000000-00001952) "1.tmp" called "CreateDirectoryW" with parameter C:\Program Files\Nero (UID: 00000000-00001952) "1.tmp" called "CreateDirectoryW" with parameter C:\Program Files\Nero\Nero Common (UID: 00000000-00001952) "1.tmp" called "CreateDirectoryW" with parameter C:\Program Files\Nero\Nero Common\AdvrCntr6 (UID: 00000000-00001952) "1.tmp" called "CreateDirectoryW" with parameter C:\Program Files\Nero\Nero Common\web\javascripts (UID: 00000000-00001952) "1.tmp" called "CreateDirectoryW" with parameter C:\Users\qtpRqgc\AppData\Local\Programs\Common (UID: 00000000-00001952)31:T47b,Sleep@KERNEL32.DLL at 00000000-00002556-21792-554-00401C7C Sleep@KERNEL32.DLL at 00000000-00002556-21792-423-004024EC Sleep@KERNEL32.DLL at 00000000-00002556-21792-879-00401E74 Sleep@KERNEL32.DLL at 00000000-00002556-21792-892-0040ABCC Sleep@KERNEL32.DLL at 00000000-00002556-21792-530-0040E5DC Sleep@KERNEL32.DLL at 00000000-00002556-21792-549-00401677 Sleep@KERNEL32.DLL at 00000000-00002556-21792-558-004018F8 Sleep@KERNEL32.DLL at 00000000-00002968-30432-4579-004B0150 Sleep@KERNEL32.DLL at 00000000-00002968-30432-2925-0040B964 Sleep@KERNEL32.DLL at 00000000-00002968-30432-4072-0046A734 Sleep@KERNEL32.DLL at 00000000-00002968-30432-1361-00480E88 Sleep@KERNEL32.DLL at 00000000-00002968-30432-4883-004CF228 Sleep@KERNEL32.DLL at 00000000-00002968-30432-4783-004C8E08 Sleep@KERNEL32.DLL at 00000000-00002968-30432-5104-004F7424 Sleep@KERNEL32.DLL at 00000000-00003560-30432-4114-004715B8 Sleep@KERNEL32.DLL at 00000000-00003560-30432-2991-00402700 Sleep@KERNEL32.DLL at 00000000-00003560-30369-876-00401E74 Sleep@KERNEL32.DLL at 00000000-00003560-30432-150-004B3C38 Sleep@KERNEL32.DLL at 00000000-00003560-30369-422-004024EC32:T548,LoadLibraryW@KERNEL32.DLL at 00000000-00002556-21792-460-0040AC84 LoadLibraryW@KERNEL32.DLL at 00000000-00002556-21792-442-004069C8 LoadLibraryExW@KERNEL32.DLL at 00000000-00002556-21792-67-00405DE8 LoadLibraryW@KERNEL32.DLL at 00000000-00002968-30432-4547-004AA464 LoadLibraryW@KERNEL32.DLL at 00000000-00002968-30432-1788-004A1A3C LoadLibraryExW@KERNEL32.DLL at 00000000-00002968-30432-72-00408370 LoadLibraryW@KERNEL32.DLL at 00000000-00002968-30432-3531-00438998 LoadLibraryW@KERNEL32.DLL at 00000000-00002968-30432-4480-004A4EC4 LoadLibraryW@KERNEL32.DLL at 00000000-00002968-30432-3029-0040A348 LoadLibraryW@KERNEL32.DLL at 00000000-00002968-30432-884-00413C38 LoadLibraryW@KERNEL32.DLL at 00000000-00002968-30432-4149-004394E8 LoadLibraryW@KERNEL32.DLL at 00000000-00002968-30432-1698-004A9DA3 LoadLibraryW@KERNEL32.DLL at 00000000-00002968-30432-4028-00469138 LoadLibraryW@KERNEL32.DLL at 00000000-00003560-30432-2027-004395AC LoadLibraryW@KERNEL32.DLL at 00000000-00003560-30432-4481-004A64B4 LoadLibraryW@KERNEL32.DLL at 00000000-00003560-30369-441-004069C8 LoadLibraryW@KERNEL32.DLL at 00000000-00003560-30369-459-0040AC84 LoadLibraryExW@KERNEL32.DLL at 00000000-00003560-30369-67-00405DE8 LoadLibraryW@KERNEL32.DLL at 00000000-00001952-36757-3531-00438998 LoadLibraryW@KERNEL32.DLL at 00000000-00001952-36757-884-00413C3833:T938,"d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin" file has an entrypoint instructions - "pushebp,movebp, esp,addesp, -0x5c,pushebx,pushesi,pushedi,xoreax, eax,movdword ptr [ebp - 0x3c], eax,movdword ptr [ebp - 0x40], eax,movdword ptr [ebp - 0x5c], eax,movdword ptr [ebp - 0x30], eax,movdword ptr [ebp - 0x38], eax,movdword ptr [ebp - 0x34], eax,movdword ptr [ebp - 0x2c], eax,movdword ptr [ebp - 0x28], eax,movdword ptr [ebp - 0x14], eax,moveax, 0x410144,call0x4065d4,xoreax, eax,pushebp,push0x411ebe,pushdword ptr fs:[eax],movdword ptr fs:[eax], esp,xoredx, edx,pushebp,push0x411e7a,pushdword ptr fs:[edx],movdword ptr fs:[edx], esp,moveax, dword ptr [0x415b48],call0x40ed40,call0x40e894,cmpbyte ptr [0x412adc], 0,je0x41184c," "is-9PSG6.tmp" file has an entrypoint instructions - "pushebp,movebp, esp,cmpdword ptr [ebp + 0xc], 1,jne0x10040888,call0x10040eb3,pushdword ptr [ebp + 0x10],pushdword ptr [ebp + 0xc],pushdword ptr [ebp + 8],call0x10040754,addesp, 0xc,popebp,ret0xc,movecx, dword ptr [ebp - 0xc],movdword ptr fs:[0], ecx,popecx,popedi,popedi,popesi,popebx,movesp, ebp,popebp,pushecx,bnd ret,movecx, dword ptr [ebp - 0x10],xorecx, ebp,bnd call0x1003fad6,bnd jmp0x1004089d,pusheax,pushdword ptr fs:[0],leaeax, [esp + 0xc],subesp, dword ptr [esp + 0xc],pushebx,pushesi,pushedi,movdword ptr [eax], ebp,movebp, eax," "Patch.tmp" file has an entrypoint instructions - "pushebp,movebp, esp,addesp, -0x10,pushebx,pushesi,pushedi,moveax, 0x4febf4,call0x408f4c,push-0x14,moveax, dword ptr [0x504e38],moveax, dword ptr [eax],movebx, dword ptr [eax + 0x170],pushebx,call0x409e0c,andeax, 0xffffff7f,pusheax,push-0x14,moveax, dword ptr [0x504e38],pushebx,call0x40a074,xoreax, eax,pushebp,push0x5015e7,pushdword ptr fs:[eax],movdword ptr fs:[eax], esp,push1,call0x4097d4,call0x4fe938,moveax, dword ptr [0x4fe82c],pusheax,push0x4fe890," "1.tmp" file has an entrypoint instructions - "pushebp,movebp, esp,addesp, -0x10,pushebx,pushesi,pushedi,moveax, 0x4febf4,call0x408f4c,push-0x14,moveax, dword ptr [0x504e38],moveax, dword ptr [eax],movebx, dword ptr [eax + 0x170],pushebx,call0x409e0c,andeax, 0xffffff7f,pusheax,push-0x14,moveax, dword ptr [0x504e38],pushebx,call0x40a074,xoreax, eax,pushebp,push0x5015e7,pushdword ptr fs:[eax],movdword ptr fs:[eax], esp,push1,call0x4097d4,call0x4fe938,moveax, dword ptr [0x4fe82c],pusheax,push0x4fe890,"34:T580,Observed import api "WNetCloseEnum" which can "ends a network resource enumeration" [Source: Patch.tmp] Observed import api "WNetEnumResource" which can "continues an enumeration of network resources" [Source: Patch.tmp] Observed import api "WNetGetConnection" which can "retrieves the name of the network resource associated with a local device" [Source: Patch.tmp] Observed import api "WNetGetUniversalName" which can "takes a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: Patch.tmp] Observed import api "WNetOpenEnum" which can "starts an enumeration of network resources or existing connections." [Source: Patch.tmp] Observed import api "WNetCloseEnum" which can "ends a network resource enumeration" [Source: 1.tmp] Observed import api "WNetEnumResource" which can "continues an enumeration of network resources" [Source: 1.tmp] Observed import api "WNetGetConnection" which can "retrieves the name of the network resource associated with a local device" [Source: 1.tmp] Observed import api "WNetGetUniversalName" which can "takes a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: 1.tmp] Observed import api "WNetOpenEnum" which can "starts an enumeration of network resources or existing connections." [Source: 1.tmp]35:T164e," Creative Content

-->

" (Indicator: "https://")36:T479,"Patch.exe" trying to access non-existent file "C:\Patch.exe.Local\" "Patch.exe" trying to access non-existent file "C:\Patch.ENU" "Patch.exe" trying to access non-existent file "C:\Patch.ENU.DLL" "Patch.exe" trying to access non-existent file "C:\Patch.EN" "Patch.exe" trying to access non-existent file "C:\Patch.EN.DLL" "Patch.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "Patch.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "Patch.exe" trying to access non-existent file "C:\PATCH.EXE.LOCAL" "Patch.exe" trying to access non-existent file "C:\PATCH.ENU" "Patch.exe" trying to access non-existent file "C:\PATCH.ENU.DLL" "Patch.exe" trying to access non-existent file "C:\PATCH.EN" "Patch.exe" trying to access non-existent file "C:\PATCH.EN.DLL" "Patch.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "Patch.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "Patch.exe" trying to access non-existent file "C:\FLTLIB.DLL"37:T76c,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Patch.tmp] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Patch.tmp] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Patch.tmp] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Patch.tmp] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: Patch.tmp] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Patch.tmp] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: Patch.tmp] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 1.tmp] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: 1.tmp] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 1.tmp] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 1.tmp] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 1.tmp] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 1.tmp] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 1.tmp]38:T5d5,SystemParametersInfoW@USER32.DLL at 00000000-00002968-30432-4195-0047A6FC SystemParametersInfoW@USER32.DLL at 00000000-00002968-30432-3401-0042DD24 SystemParametersInfoW@USER32.DLL at 00000000-00002968-30432-4714-004BFA6C SystemParametersInfoW@USER32.DLL at 00000000-00002968-30432-4227-0047A3B8 SystemParametersInfoW@USER32.DLL at 00000000-00002968-30432-4039-00479D8C SystemParametersInfoW@USER32.DLL at 00000000-00002968-30432-4044-004690D4 SystemParametersInfoW@USER32.DLL at 00000000-00002968-30432-3403-0042DF04 SystemParametersInfoW@USER32.DLL at 00000000-00002968-30432-4045-0046902C SystemParametersInfoW@USER32.DLL at 00000000-00002968-30432-643-0047A6A0 SystemParametersInfoW@USER32.DLL at 00000000-00002968-30432-3935-004655D8 SystemParametersInfoW@USER32.DLL at 00000000-00003560-30432-703-004FA8F0 SystemParametersInfoW@USER32.DLL at 00000000-00003560-30432-644-0047A670 SystemParametersInfoW@USER32.DLL at 00000000-00003560-30432-3702-00450788 SystemParametersInfoW@USER32.DLL at 00000000-00003560-30432-3402-0042DE14 SystemParametersInfoW@USER32.DLL at 00000000-00001952-36757-3402-0042DE14 SystemParametersInfoW@USER32.DLL at 00000000-00001952-36757-3401-0042DD24 SystemParametersInfoW@USER32.DLL at 00000000-00001952-36757-3403-0042DF04 SystemParametersInfoW@USER32.DLL at 00000000-00001952-36757-3702-00450788 SystemParametersInfoW@USER32.DLL at 00000000-00001952-36757-643-0047A6A0 SystemParametersInfoW@USER32.DLL at 00000000-00001952-36757-644-0047A67039:T733,"Patch.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\is-TO1IB.tmp\Patch.tmp" with delete access "Patch.tmp" opened "C:\Users\%OSUSER%\AppData\Local\Temp\is-EDDIF.tmp\is-S597F.tmp" with delete access "Patch.tmp" opened "C:\Users\%OSUSER%\AppData\Local\Temp\is-EDDIF.tmp\1.exe" with delete access "1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\is-5JN7V.tmp\1.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero 2021\Nero Vision\is-A55FO.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero 2021\Nero Vision\is-VJ80L.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero 2021\Nero Vision\is-G11UF.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero 2021\Nero Vision\is-UQ667.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero 2021\Nero Vision\is-1MJD1.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero 2021\Nero Vision\is-I1BF9.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero Common\AdvrCntr6\is-KD5RC.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero Common\web\is-1T5Q1.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero Common\web\is-3JK0J.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero Common\web\is-IPB3K.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero Common\web\is-M7JQD.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero Common\web\is-PJL1F.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero Common\web\is-SJN2V.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero Common\web\is-4DL1P.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero Common\web\is-6ELG5.tmp" with delete access "1.tmp" opened "C:\Program Files\Nero\Nero Common\web\is-QCKT9.tmp" with delete access3a:T5a1,"Patch.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-TO1IB.tmp\Patch.tmp" (Handle: 176) "Patch.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-TO1IB.tmp\Patch.tmp" (Handle: 176) "Patch.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-TO1IB.tmp\Patch.tmp" (Handle: 176) "Patch.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-TO1IB.tmp\Patch.tmp" (Handle: 176) "Patch.tmp" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-EDDIF.tmp\1.exe" (Handle: 436) "Patch.tmp" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-EDDIF.tmp\1.exe" (Handle: 436) "Patch.tmp" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-EDDIF.tmp\1.exe" (Handle: 436) "Patch.tmp" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-EDDIF.tmp\1.exe" (Handle: 436) "1.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-5JN7V.tmp\1.tmp" (Handle: 176) "1.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-5JN7V.tmp\1.tmp" (Handle: 176) "1.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-5JN7V.tmp\1.tmp" (Handle: 176) "1.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-5JN7V.tmp\1.tmp" (Handle: 176)3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4hwAAAAAAAAAAAAAAAIh3d3d3iAAAAAAAAAAAAIiIiIiIiIiIAAAAAAAAAAiIiIj//4iIiIAAAAAAAACIiI9zMzMziIiIcAAAAAAIiI93d3d3d3f4iIcAAAAAiIiIiIiIiIiIiIiIAAAACIiPiIiIiIiIiIj4iIAAAAiIj4iIiIiPeIiI94iHAACIiD+I/4iIj3iIiPP4iAAAiIc///iIj/h4///zOIgACIiDn/iIiIiIeIiP8ziIgAiIg5//j/j//3////M3iIAIiHOf///////////zk4iACIh5n////4iIiP//85OIgAiIeZ////////////OT+IAIj3mfiI+IiIiIiIjzk4iACI95n4////+I//+I85P4gAiPiZiPd4h/h3hz+IOX+IAIj4OYiHiIiIt7t3d5mPiAAP/3mIiIiHiIh3d3eT/4AACP+DiIh4iIeIh3d3mPiAAAf/+DiIiI/4iIiIh3/4cAAA//94iIiIh/iHiIP/+AAAAA//94iIiIiHh4d4//AAAAAH//+DiIiIiIiP//9wAAAAAH//+IM4iIM3iP/3AAAAAAAA////iIiIiI//cAAAAAAAAAj/+IiIiIiPgAAAAAAAAAAACP+IiIiPgAAAAAAAAAAAAAAAeIiHAAAAAAAAD//j///8AB//8AAH/+AAA//AAAH/gAAA/wAAAH4AAAA+AAAAPAAAABwAAAAYAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAADAAAABwAAAAcAAAAHgAAAD8AAAB/AAAAf4AAAP/gAAP/8AAH//wAH///gP/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample d05cdbdad762… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample d05cdbdad762…. Threat score 0/100. 0/28 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"Patch.exe\",\"applicationCategory\":[\"peexe\",\"executable\"],\"identifier\":\"d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":28},\"behavioralIndicators\":{\"malicious\":7,\"suspicious\":17},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1790489081625,"unified_at":"2026-09-27T06:04:41.625Z","metadata":{"hashes":{"sha256":"d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0","sha1":"2fbba27423385faca546d05d4d2ece21bfd96116","md5":"b674ea260960652e83a6deb59d03e545","sha512":"bfb351281b7d14b909505a11546e8912f763e6041b483492e93073f32829b8e1b9e1eae9f6eaf2fdb8c724493fa608faf7d4b9c4463c44da1d0ff91bd2bc0781","ssdeep":"196608:gT3cIwAynD+YhBPxFwyMc1r0MCR8nJiI6SoJhhDOJ:0czAyD+YhBPxFwyMco8JVvAhDOJ","ssdeep_chunks":["196608:gT3cIwA","196608:T3cIwAy","196608:3cIwAyn","196608:cIwAynD","196608:IwAynD+","196608:wAynD+Y","196608:AynD+Yh","196608:ynD+YhB","196608:nD+YhBP","196608:D+YhBPx","196608:+YhBPxF","196608:YhBPxFw","196608:hBPxFwy","196608:BPxFwyM","196608:PxFwyMc","196608:xFwyMc1","196608:FwyMc1r","196608:wyMc1r0","196608:yMc1r0M","196608:Mc1r0MC","196608:c1r0MCR","196608:1r0MCR8","196608:r0MCR8n","196608:0MCR8nJ","196608:MCR8nJi","196608:CR8nJiI","196608:R8nJiI6","196608:8nJiI6S","196608:nJiI6So","196608:JiI6SoJ","196608:iI6SoJh","196608:I6SoJhh","196608:6SoJhhD","196608:SoJhhDO","196608:oJhhDOJ","393216:gT3cIwA","393216:T3cIwAy","393216:3cIwAyn","393216:cIwAynD","393216:IwAynD+","393216:wAynD+Y","393216:AynD+Yh","393216:ynD+YhB","393216:nD+YhBP","393216:D+YhBPx","393216:+YhBPxF","393216:YhBPxFw","393216:hBPxFwy","393216:BPxFwyM","393216:PxFwyMc","393216:xFwyMc1","393216:FwyMc1r","393216:wyMc1r0","393216:yMc1r0M","393216:Mc1r0MC","393216:c1r0MCR","393216:1r0MCR8","393216:r0MCR8n","393216:0MCR8nJ","393216:MCR8nJi","393216:CR8nJiI","393216:R8nJiI6","393216:8nJiI6S","393216:nJiI6So","393216:JiI6SoJ","393216:iI6SoJh","393216:I6SoJhh","393216:6SoJhhD","393216:SoJhhDO","393216:oJhhDOJ","196608:0czAyD+","196608:czAyD+Y","196608:zAyD+Yh","196608:AyD+YhB","196608:yD+YhBP","196608:xFwyMco","196608:FwyMco8","196608:wyMco8J","196608:yMco8JV","196608:Mco8JVv","196608:co8JVvA","196608:o8JVvAh","196608:8JVvAhD","196608:JVvAhDO","196608:VvAhDOJ"],"imphash":"20dd26497880c05caed9305b3c8b9109"},"file_info":{"file_name":"Patch.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":12322168,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1602702511000,"last_seen":1676685576000,"last_multi_scan":1676685576000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":["addrop","adposhel","adware","downloadassistant","dropper","mofksys","oxypumper","evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":40},"sandbox_signatures":{"informative_count":82,"suspicious_count":17,"malicious_count":7,"total":106},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/techniques/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typicaally used to find a resource in a module"},{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to install a hook procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to enable or disable privileges in the specified access token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Contains ability to detect sandbox (mouse cursor movement)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal on Host","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"malicious","value":"PE file contains executable resources"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"malicious","value":"Contains ability to discover network shares"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Imports windows networking related APIs"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Imports GetEnvironmentVariable API"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Contains ability to retrieve the name of the user associated with the current thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retreive system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query local/system time"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to take screen capture of the target machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"Patch.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PATCH.TMP\")\n \"Patch.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PATCH.TMP\")\n \"Patch.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\NERO VIDEO 2021 PATCH BY K_IS1\")\n \"Patch.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\NERO VIDEO 2021 PATCH BY K_IS1\")\n \"1.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\1_IS1\")\n \"1.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\1_IS1\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/71 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"_ldap._tcp.dc._msdcs.scl3.dc\"\n \"isatap.scl3.dc\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"Patch.exe\" created file \"%TEMP%\\is-2C5G4.tmp\\Patch.tmp\"\n \"1.exe\" created file \"%TEMP%\\is-MSL5D.tmp\\1.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Patch.tmp\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"_setup64.tmp\" as clean (type is \"PE32+ executable (console) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Patch.tmp\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"Patch.tmp\" touched \"Microsoft Multiple AutoComplete List Container\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00BB2765-6A77-11D0-A535-00C04FD7D062}\")\n \"Patch.tmp\" touched \"Microsoft Shell Folder AutoComplete List\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{03C036F1-A186-11D0-824A-00AA005B4383}\\TREATAS\")\n \"Patch.tmp\" touched \"Microsoft AutoComplete\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00BB2763-6A77-11D0-A535-00C04FD7D062}\\TREATAS\")\n \"Patch.tmp\" touched \"Microsoft TipAutoCompleteClient Control\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\\TREATAS\")\n \"Patch.tmp\" touched \"Task Bar Communication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Patch.tmp\" (UID: 00064723-00002120) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"Patch.tmp\" (UID: 00064723-00002120) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Patch.tmp\" with commandline \"/SL5=\"$50184\n10181930\n190976\nC:\\Patch.exe\"\" (UID: 00064723-00002120)\n Spawned process \"1.exe\" with commandline \"/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-\" (UID: 00065903-00002740)\n Spawned process \"1.tmp\" with commandline \"/SL5=\"$3029A\n8751720\n121344\n%TEMP%\\is-OJ4RO.tmp\\1.exe\" /VERYSILE ...\" (UID: 00066033-00001724)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Patch.tmp\" with commandline \"/SL5=\"$50184\n10181930\n190976\nC:\\Patch.exe\"\" (UID: 00064723-00002120)\n Spawned process \"1.exe\" with commandline \"/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-\" (UID: 00065903-00002740)\n Spawned process \"1.tmp\" with commandline \"/SL5=\"$3029A\n8751720\n121344\n%TEMP%\\is-OJ4RO.tmp\\1.exe\" /VERYSILE ...\" (UID: 00066033-00001724)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$24","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Patch.tmp\" opened \"\\Device\\KsecDD\"\n \"1.tmp\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin\" was detected as \"Borland Delphi 4.0\"\n \"is-C43EB.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"Patch.tmp\" was detected as \"Borland Delphi 4.0\"\n \"is-G6MV5.tmp\" was detected as \"VC8 -> Microsoft Corporation\"\n \"_setup64.tmp\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Patch.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"1.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/79 reputation engines marked \"http://www.remobjects.com/ps\" as malicious (1% detection rate)\n 1/79 reputation engines marked \"http://www.jrsoftware.org/ishelp/index.php\" as malicious (1% detection rate)\n 1/79 reputation engines marked \"http://www.innosetup.com/\" as malicious (1% detection rate)\n 1/79 reputation engines marked \"http://www.innosetup.com\" as malicious (1% detection rate)\n 1/78 reputation engines marked \"http://www.kymoto.org\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"bauer@ozm.cz\"\n Pattern match: \"mlaan@jrsoftware.org\"\n Pattern match: \"pierre@levosgien.net\"\n Pattern match: \"eivind@nexusdb.com\"\n Pattern match: \"nars@gmx.net\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"is-C43EB.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"Patch.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"is-G6MV5.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"is-0R9E5.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"is-H1EGB.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"_setup64.tmp\" has type \"PE32+ executable (console) x86-64 for MS Windows\"\n \"is-JPJVM.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"_ldap._tcp.dc._msdcs.scl3.dc\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"169.254.100.12/32, 192.168.240.2/32, 192.168.241.120/32, 192.168.241.125/32, 192.168.242.49/32, 192.168.242.71/32, 192.168.242.219/32, 192.168.243.128/32, 192.168.243.187/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"\"\n Heuristic match: \"\"\n Heuristic match: \"\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"is-C43EB.tmp\" claimed CRC 1403556 while the actual is CRC 12328908\n \"is-G6MV5.tmp\" claimed CRC 2776531 while the actual is CRC 1267814\n \"is-H1EGB.tmp\" claimed CRC 489390 while the actual is CRC 2776641\n \"_setup64.tmp\" claimed CRC 11292 while the actual is CRC 489500","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$27","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"Patch.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"1.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"malicious","category":"Network Related","name":"Detected a large number of ARP broadcast requests (network device lookup)","description":"$29","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":10,"id":"network-31","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typicaally used to find a resource in a module","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"Patch.exe\" called \"LoadResource\" (UID: 00000000-00002556)\n \"Patch.tmp\" called \"LoadResource\" (UID: 00000000-00002968)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"Patch.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-TO1IB.tmp (UID: 00000000-00002556)\n \"Patch.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-EDDIF.tmp\\_isetup (UID: 00000000-00002968)\n \"Patch.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-EDDIF.tmp (UID: 00000000-00002968)\n \"1.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-5JN7V.tmp (UID: 00000000-00003560)\n \"1.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-VK7UA.tmp\\_isetup (UID: 00000000-00001952)\n \"1.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-VK7UA.tmp (UID: 00000000-00001952)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to install a hook procedure (API string)","description":"Observed api string:\"SetWindowsHookExW\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed api string:\"UnhandledExceptionFilter\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Patch.tmp\" called \"GetForegroundWindow\" (UID: 00000000-00002968)\n \"1.tmp\" called \"GetForegroundWindow\" (UID: 00000000-00001952)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Patch.tmp\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00002968)\n \"1.tmp\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00001952)\n \"1.tmp\" called \"RtlGetNtProductType\" (UID: 00000000-00001952)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"Patch.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002556)\n \"Patch.tmp\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002968)\n \"Patch.tmp\" called \"RtlGetVersion\" (UID: 00000000-00002968)\n \"1.exe\" called \"RtlGetVersion\" (UID: 00000000-00003560)\n \"1.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003560)\n \"1.tmp\" called \"RtlGetVersion\" with parameter (UID: 00000000-00001952)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"Patch.tmp\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002968)\n \"Patch.tmp\" called \"OpenMutexW\" (UID: 00000000-00002968)\n \"Patch.tmp\" called \"OpenMutexW\" with parameter \"DefaultTabtip-MainUI\" - (UID: 00000000-00002968)\n \"1.tmp\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00001952)\n \"1.tmp\" called \"OpenMutexW\" with parameter \"DefaultTabtip-MainUI\" - (UID: 00000000-00001952)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"$2b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.DLL at 00000000-00002968-30432-4741-004C0F14\n GetLogicalDrives@KERNEL32.DLL at 00000000-00002968-30432-4733-004C0AE4\n GetDriveTypeW@KERNEL32.DLL at 00000000-00002968-30432-4788-004CA018","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002968-30432-1172-004B3678\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00002968-30432-1435-004CC9E0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002968-30432-4607-004B2824\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00003560-30432-94-004B2868\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00001952-36757-94-004B2868\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00001952-36757-1435-004CC9E0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001952-36757-1172-004B3678","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00002968-30432-364-0040F594\n GetLocalTime@KERNEL32.DLL at 00000000-00002968-30432-4823-004CD490\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002968-30432-1172-004B3678\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002968-30432-4607-004B2824\n GetLocalTime@KERNEL32.DLL at 00000000-00002968-30432-5100-0040F544\n GetLocalTime@KERNEL32.DLL at 00000000-00003560-30432-4816-004CCEA4\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003560-30432-94-004B2868\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001952-36757-94-004B2868\n GetLocalTime@KERNEL32.DLL at 00000000-00001952-36757-364-0040F594\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001952-36757-1172-004B3678","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00002556-21792-448-00408068\n GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00002968-30432-3054-0040DC84\n GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00002968-30432-4587-004B0A78\n GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00003560-30369-447-00408068\n GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00001952-36757-3054-0040DC84","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Patch.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Patch.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Patch.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Patch.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"1.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"1.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"1.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retreive system language (API string)","description":"Observed api:\"GetKeyboardType\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]\n Observed api:\"GetUserDefaultLangID\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]\n Observed api:\"GetKeyboardLayoutList\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]\n Observed api:\"GetUserDefaultUILanguage\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Observed api:\"GetWindowText\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]\n Observed api:\"GetForegroundWindow\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string:\"GetStartupInfo\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$2f","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$30","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Patch.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\is-TO1IB.tmp\\Patch.tmp\" /SL5=\"$70218\n10181930\n190976\nC:\\Patch.exe\" \" - (UID: 00000000-00002556)\n \"Patch.tmp\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\is-EDDIF.tmp\\1.exe\" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-\" - (UID: 00000000-00002968)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@KERNEL32.DLL at 00000000-00002968-30432-1172-004B3678\n CreateNamedPipeW@KERNEL32.DLL at 00000000-00001952-36757-1172-004B3678","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$31","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-9PSG6.tmp)","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"$32","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"Observed API string:\"CreateThread\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"is-9PSG6.tmp\" contains export function called \"_AMCInit@0\" at ordinal 1\n \"is-9PSG6.tmp\" contains export function called \"_AMCUnInit@0\" at ordinal 2\n \"is-9PSG6.tmp\" contains export function called \"_Trace@4\" at ordinal 3","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\"\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\ProfileReconciliation\"\n \"SOFTWARE\\Borland\\Delphi\\RTL\"\n \"Software\\CodeGear\\Locales\"\n \"Software\\Borland\\Locales\"\n \"Software\\Borland\\Delphi\\Locales\"\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\"\n \"\\SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts\\\"\n \"System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs\"\n \"SYSTEM\\CurrentControlSet\\Control\\Session Manager\"\n \"@Software\\Microsoft\\Windows\\CurrentVersion\\Fonts\"\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Fonts\"\n \"SOFTWARE\\Microsoft\\.NETFramework\"\n \"SOFTWARE\\Microsoft\\.NETFramework\\Policy\\v4.0\"\n \"SOFTWARE\\Microsoft\\.NETFramework\\Policy\\v2.0\"\n \"SOFTWARE\\Microsoft\\.NETFramework\\Policy\\v1.1\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"GetLongPathNameW\" (Indicator: \"GetLongPathNameW\")\n \"SysFreeString\" (Indicator: \"SysFreeString\")\n \"SysAllocStringLen\" (Indicator: \"SysAllocString\")\n \"RegQueryValueExW\" (Indicator: \"RegQueryValueExW\")\n \"RegOpenKeyExW\" (Indicator: \"RegOpenKeyExW\")\n \"RegCloseKey\" (Indicator: \"RegCloseKey\")\n \"LoadStringW\" (Indicator: \"LoadStringW\")\n \"MessageBoxA\" (Indicator: \"MessageBoxA\")\n \"VirtualFree\" (Indicator: \"VirtualFree\")\n \"VirtualAlloc\" (Indicator: \"VirtualAlloc\")\n \"GetSystemInfo\" (Indicator: \"GetSystemInfo\")\n \"GetTickCount\" (Indicator: \"GetTickCount\")\n \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\")\n \"GetVersion\" (Indicator: \"GetVersion\")\n \"GetCurrentThreadId\" (Indicator: \"GetCurrentThread\")\n \"VirtualQuery\" (Indicator: \"VirtualQuery\")\n \"WideCharToMultiByte\" (Indicator: \"WideCharToMultiByte\")\n \"MultiByteToWideChar\" (Indicator: \"MultiByteToWideChar\")\n \"LoadLibraryExW\" (Indicator: \"LoadLibraryExW\")\n \"GetStartupInfoA\" (Indicator: \"GetStartupInfoA\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"PE file contains data exceeding the last FAT sector (overlay)","description":"Pe file has Overlay in d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin","origin":"Static Parser","relevance":1,"id":"static-131","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin\" has an executable section named \".text\"\n \"d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin\" has an executable section named \".itext\"\n \"is-9PSG6.tmp\" has an executable section named \".text\"\n \"Patch.tmp\" has an executable section named \".text\"\n \"Patch.tmp\" has an executable section named \".itext\"\n \"1.tmp\" has an executable section named \".text\"\n \"1.tmp\" has an executable section named \".itext\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin\" has an writable section named \".data\"\n \"d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin\" has an writable section named \".bss\"\n \"d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin\" has an writable section named \".idata\"\n \"d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin\" has an writable section named \".tls\"\n \"is-9PSG6.tmp\" has an writable section named \".data\"\n \"is-9PSG6.tmp\" has an writable section named \".shared\"\n \"is-9PSG6.tmp\" has an writable section named \".tls\"\n \"Patch.tmp\" has an writable section named \".data\"\n \"Patch.tmp\" has an writable section named \".bss\"\n \"Patch.tmp\" has an writable section named \".idata\"\n \"Patch.tmp\" has an writable section named \".tls\"\n \"1.tmp\" has an writable section named \".data\"\n \"1.tmp\" has an writable section named \".bss\"\n \"1.tmp\" has an writable section named \".idata\"\n \"1.tmp\" has an writable section named \".tls\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$33","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Patch.tmp\" searching for class \"Shell_TrayWnd\"\n \"1.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"Patch.exe\" connecting to \"\\ThemeApiPort\"\n \"Patch.tmp\" connecting to \"\\ThemeApiPort\"\n \"1.exe\" connecting to \"\\ThemeApiPort\"\n \"1.tmp\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00000000-00003560-30432-776-004B0060\n GetUserNameW@ADVAPI32.DLL at 00000000-00001952-36757-776-004B0060","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Observed api string:\"WNetOpenEnumW which can Starts an enumeration of network resources or existing connections\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]\n Observed api string:\"WNetGetUniversalNameW which can takes a drive-based path for a network resource and returns an information structure that contains a more universal form of the name\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]\n Observed api string:\"WNetGetConnectionW which can retrieves the name of the network resource associated with a local device\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]\n Observed api string:\"WNetEnumResourceW which can continues an enumeration of network resources\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]\n Observed api string:\"WNetCloseEnum which can ends a network resource enumeration\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"$34","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00002556-21792-521-0040E11C\n Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00002556-21792-520-0040E158\n Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00002968-30432-135-004ACF94\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00002968-30432-136-004ACF58\n Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00003560-30369-519-0040E158\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00003560-30369-520-0040E11C\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00001952-36757-136-004ACF58\n Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00001952-36757-135-004ACF94","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed api string:\"SystemParametersInfoW\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"Patch.tmp\" called \"CreateCompatibleBitmap\" (UID: 00000000-00002968)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"Patch.exe\" called \"FindFirstFileW\" (UID: 00000000-00002556)\n \"Patch.exe\" called \"FindNextFileW\" (UID: 00000000-00002556)\n \"Patch.tmp\" called \"FindNextFileW\" (UID: 00000000-00002968)\n \"Patch.tmp\" called \"FindFirstFileW\" (UID: 00000000-00002968)\n \"1.exe\" called \"FindFirstFileW\" (UID: 00000000-00003560)\n \"1.exe\" called \"FindNextFileW\" (UID: 00000000-00003560)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (mouse cursor movement)","description":"Found GetCursorPos() in an import section (Source: Patch.tmp)\n Found GetCursorPos() in an import section (Source: 1.tmp)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Observed api string:\"GetDriveTypeW\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindFirstFileW\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Observed api string:\"GetKeyState\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed api string:\"GetNativeSystemInfo\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Observed api string:\"GetComputerNameW\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed API string:\"GetModuleFileName\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed api string:\"GetEnvironmentVariableW\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the name of the user associated with the current thread (API string)","description":"Observed api string:\"GetUserNameW\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed api string:\"GetSystemMetrics\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to take screen capture of the target machine (API string)","description":"Observed api string:\"CreateCompatibleBitmap\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetEnvironmentVariable API","description":"Observed import api \"GetEnvironmentVariable\" which can \"read the host's architecture\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]\n Observed import api \"GetEnvironmentVariable\" which can \"read the host's architecture\" [Source: is-9PSG6.tmp]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-81","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"System Security","name":"Contains ability to enable or disable privileges in the specified access token (API string)","description":"Observed api string:\"AdjustTokenPrivileges\" [Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Observed api string:\"SetSecurityDescriptorDacl which can Sets information in a discretionary access control list (DACL)\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]\n Observed api string:\"InitializeSecurityDescriptor which can Initializes a new security descriptor\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]\n Observed api string:\"GetTokenInformation which can Retrieves a specified type of information about an access token\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]\n Observed api string:\"AllocateAndInitializeSid which can Allocates and initializes a security identifier (SID) with up to eight subauthorities\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]\n Observed api string:\"AllocateAndInitializeSid which can Initializes a security identifier (SID)\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Observed api string:\"SeShutdownPrivilege which can Shut down the system\"[Source: d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0.bin]","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$37","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Patch.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\is-TO1IB.tmp\\Patch.tmp]- [targetUID: 00000000-00002556]\n \"1.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\is-5JN7V.tmp\\1.tmp]- [targetUID: 00000000-00003560]","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"1.tmp\" queried SystemProcessInformation at 00000000-00001952-00000105-1129635\n \"1.tmp\" queried SystemProcessInformation at 00000000-00001952-00000105-1130057","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.DLL at 00000000-00002556-21792-96-0040EE14\n LoadResource@KERNEL32.DLL at 00000000-00002968-30432-3045-0040AA2C\n LoadResource@KERNEL32.DLL at 00000000-00002968-30432-1013-00426A4C\n FindResourceW@KERNEL32.DLL at 00000000-00003560-30432-984-004230E4\n LoadResource@KERNEL32.DLL at 00000000-00003560-30369-96-0040EE14\n LoadResource@KERNEL32.DLL at 00000000-00001952-36757-3045-0040AA2C\n LoadResource@KERNEL32.DLL at 00000000-00001952-36757-1013-00426A4C\n FindResourceW@KERNEL32.DLL at 00000000-00001952-36757-984-004230E4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"Patch.exe\" wrote 4608 bytes starting with PE header signature to file \"%TEMP%\\is-TO1IB.tmp\\Patch.tmp\": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ...","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"$38","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Patch.exe\" marked \"%TEMP%\\is-TO1IB.tmp\\Patch.tmp\" for deletion\n \"Patch.tmp\" marked \"%TEMP%\\is-EDDIF.tmp\\1.exe\" for deletion\n \"1.exe\" marked \"%TEMP%\\is-5JN7V.tmp\\1.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$39","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"PE file contains executable resources","description":"Patch.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (console) x86-64\n for MS Windows\n Patch.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB)\n for MS Windows\n 1.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (console) x86-64\n for MS Windows\n 1.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB)\n for MS Windows","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"malicious","category":"Environment Awareness","name":"Contains ability to discover network shares","description":"WNetOpenEnumW@MPR.DLL at 00000000-00002968-30432-3052-0040D850\n WNetOpenEnumW@MPR.DLL at 00000000-00001952-36757-3052-0040D850","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1135","relevance":5,"id":"stream-69","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"2/88 Antivirus vendors marked dropped file \"is-GHO19.tmp\" as malicious (classified as \"PE.Heur\" with 2% detection rate)\n 1/67 Antivirus vendors marked dropped file \"is-9PSG6.tmp\" as malicious (classified as \"PE.Heur\" with 1% detection rate)\n 1/90 Antivirus vendors marked dropped file \"Patch.tmp\" as malicious (classified as \"W32.Neshta.D\" with 1% detection rate)\n 1/94 Antivirus vendors marked dropped file \"1.tmp\" as malicious (classified as \"W32.Neshta.D\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"1/90 Antivirus vendors marked spawned process \"Patch.tmp\" (PID: 2968) as malicious (classified as \"W32.Neshta.D\" with 1% detection rate)\n 2/59 Antivirus vendors marked spawned process \"1.exe\" (PID: 3560) as malicious (classified as \"BehavesLike.AdwareFileTour\" with 3% detection rate)\n 1/94 Antivirus vendors marked spawned process \"1.tmp\" (PID: 1952) as malicious (classified as \"W32.Neshta.D\" with 1% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$3a","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00002968-30432-118-004B00AC\n ExitWindowsEx@USER32.DLL at 00000000-00001952-36757-118-004B00AC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to read the keyboard layout followed by a significant code branch decision"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":55,"dropped_files_count":0,"extracted_files_count":40,"files_written_count":39,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["addrop","adposhel","adware","downloadassistant","dropper","mofksys","oxypumper","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"63b202a47e8b781d122e3244","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"Patch.exe","analysis_start_time":"2023-01-01T22:01:12+00:00","indicators_count":{"informative":81,"suspicious":48,"malicious":7},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"5f874caf5a149f2d7308c3e1","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"Patch.exe","analysis_start_time":"2020-10-14T19:08:41+00:00","indicators_count":{"informative":16,"suspicious":14,"malicious":1},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"_ldap._tcp.dc._msdcs.scl3.dc","ttl":86384,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"domain":"isatap.scl3.dc","ttl":86398,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}],"processes":[{"pid":3344,"ppid":0,"name":"Patch.exe","command_line":"","sha256":"d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0","normalized_path":"C:\\Patch.exe","uid":"00064592-00003344","icon":"$3b"},{"pid":2120,"ppid":3344,"name":"Patch.tmp","command_line":"/SL5=\"$50184,10181930,190976,C:\\Patch.exe\"","sha256":"8552ab894691d42b2623c2479c7c4c86211c090d1478d22b2dc6ed5b8b0108e7","normalized_path":"%TEMP%\\is-2C5G4.tmp\\Patch.tmp","parent_uid":"00064592-00003344","uid":"00064723-00002120"},{"pid":2740,"ppid":2120,"name":"1.exe","command_line":"/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-","sha256":"ae00063f9d184ae5b6f44fde25cd34fda2c03825ab2fc9e685da32007ae83e08","normalized_path":"%TEMP%\\is-OJ4RO.tmp\\1.exe","parent_uid":"00064723-00002120","uid":"00065903-00002740"},{"pid":1724,"ppid":2740,"name":"1.tmp","command_line":"/SL5=\"$3029A,8751720,121344,%TEMP%\\is-OJ4RO.tmp\\1.exe\" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-","sha256":"f51527cf093c4bd545e1f653c9b0a74089c4acd1029f294f8358b3575f841fb2","normalized_path":"%TEMP%\\is-MSL5D.tmp\\1.tmp","parent_uid":"00065903-00002740","uid":"00066033-00001724"}],"all_imported_dlls":["msctf.dll","apphelp.dll","sspicli.dll","lpk.dll","msimg32.dll","version.dll","sfc_os.dll","cfgmgr32.dll","devobj.dll","dui70.dll","bcrypt.dll","wow64cpu.dll","kernel32.dll","uxtheme.dll","clbcatq.dll","sfc.dll","setupapi.dll","devrtl.dll","duser.dll","advapi32.dll","shell32.dll","netmsg.dll","cryptbase.dll","mpr.dll","profapi.dll","ExplorerFrame.dll","msasn1.dll","usp10.dll","comdlg32.dll","ncrypt.dll","ntdll.dll","comctl32.dll","tiptsf.dll","RstrtMgr.dll","shlwapi.dll","gdi32.dll","user32.dll","bcryptprimitives.dll","KernelBase.dll","oleaut32.dll","rpcrt4.dll","ole32.dll","api-ms-win-core-synch-l1-2-0.dll","dwmapi.dll","shfolder.dll","imageres.dll","wow64.dll","wow64win.dll","msvcrt.dll","sechost.dll","imm32.dll","rpcss.dll","nsi.dll","ws2_32.dll","fltLib.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"is-71NQG.tmp","sha256":"4d1bdf2d0e63f32a8fda4eeca968626ecfbc71669cb1033842abd34b4de9e649","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-AGM7O.tmp","sha256":"4d1bdf2d0e63f32a8fda4eeca968626ecfbc71669cb1033842abd34b4de9e649","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-ALO5G.tmp","sha256":"4d1bdf2d0e63f32a8fda4eeca968626ecfbc71669cb1033842abd34b4de9e649","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-IHLUL.tmp","sha256":"4d1bdf2d0e63f32a8fda4eeca968626ecfbc71669cb1033842abd34b4de9e649","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-1OK2O.tmp","sha256":"4d1bdf2d0e63f32a8fda4eeca968626ecfbc71669cb1033842abd34b4de9e649","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-4ADUE.tmp","sha256":"80505086a5b73732369611c44c84c76047b9a70e70dbfd119170ecbd0e071629","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-C43EB.tmp","sha256":"22210954c5a50146df28801bd3ab2ffe9d9e97770538b20577687df19748f933","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-G6MV5.tmp","sha256":"02921e279f6194d935c28be518839916132abd0c2b7b1cfdddb9840d7d37e1d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-H1EGB.tmp","sha256":"a3d3cdae6f4bdaa4d16437bc9f032a7879d613af511b75b36066f65a86b89b3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-JPJVM.tmp","sha256":"03a9c661e0c8c1167a0b7781376ee61fdcd7d9e72cab0ebbda192dbecf559d14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-0R9E5.tmp","sha256":"58ae37fe9a0a80b25a23daa9a59dcd2d6f8a571224c17045a9d48c267b6d3f9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-32UVC.tmp","sha256":"6c03e9746fd05b473619d60ef71d9b56a5451bb4acac507fe17fce3d6505291f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-39R88.tmp","sha256":"2c50e3875e51f0ce4973c1b1ebec58b9d194daa01b1785adb893aecee5e3dd8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-3VQGJ.tmp","sha256":"b42d3f00286d3886275bc368ef7096a0c5e4c30bc88b7ebdbab38393776be0bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-7EQKP.tmp","sha256":"b64e447e4feffdd12fca800a20743bc95ee7d5aa0045165d96e2aabb8f74be4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-8IBM2.tmp","sha256":"b889fb874f7585a07cf38eade6c41db5a77d769c5bbcf374ffaca6956de07d5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-96QFH.tmp","sha256":"38d8dcaa70dc735a9f6a8a9dec357af7f43c39edaaaa3122d26b8d03e0d7c7fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-BJTEQ.tmp","sha256":"dced10dea65bb3798a1ddd2c5cb49eb10c7b9d3e341b84f1c7636c4d58cd64d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-EJH6S.tmp","sha256":"9c22bab06fb80c24fdaa38aa0352d5a3e1b0d82d1e21f5965d3ae2784b1ac79e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-OCB6U.tmp","sha256":"416f4796d85ea00af20423ec72055ff885328933d386bc92a3bde0922f0db11f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"name":"is-9PSG6.tmp","sha256":"22210954c5a50146df28801bd3ab2ffe9d9e97770538b20577687df19748f933","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-GHO19.tmp","sha256":"58ae37fe9a0a80b25a23daa9a59dcd2d6f8a571224c17045a9d48c267b6d3f9d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-VJ80L.tmp","sha256":"03a9c661e0c8c1167a0b7781376ee61fdcd7d9e72cab0ebbda192dbecf559d14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-D13Q8.tmp","sha256":"4d1bdf2d0e63f32a8fda4eeca968626ecfbc71669cb1033842abd34b4de9e649","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-G11UF.tmp","sha256":"4d1bdf2d0e63f32a8fda4eeca968626ecfbc71669cb1033842abd34b4de9e649","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-PI08N.tmp","sha256":"4d1bdf2d0e63f32a8fda4eeca968626ecfbc71669cb1033842abd34b4de9e649","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-UQ667.tmp","sha256":"4d1bdf2d0e63f32a8fda4eeca968626ecfbc71669cb1033842abd34b4de9e649","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-1MJD1.tmp","sha256":"4d1bdf2d0e63f32a8fda4eeca968626ecfbc71669cb1033842abd34b4de9e649","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-7EPRT.tmp","sha256":"80505086a5b73732369611c44c84c76047b9a70e70dbfd119170ecbd0e071629","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-A55FO.tmp","sha256":"a3d3cdae6f4bdaa4d16437bc9f032a7879d613af511b75b36066f65a86b89b3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-I1BF9.tmp","sha256":"02921e279f6194d935c28be518839916132abd0c2b7b1cfdddb9840d7d37e1d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-1T5Q1.tmp","sha256":"2c50e3875e51f0ce4973c1b1ebec58b9d194daa01b1785adb893aecee5e3dd8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-3JK0J.tmp","sha256":"9c22bab06fb80c24fdaa38aa0352d5a3e1b0d82d1e21f5965d3ae2784b1ac79e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-4DL1P.tmp","sha256":"dced10dea65bb3798a1ddd2c5cb49eb10c7b9d3e341b84f1c7636c4d58cd64d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-6ELG5.tmp","sha256":"38d8dcaa70dc735a9f6a8a9dec357af7f43c39edaaaa3122d26b8d03e0d7c7fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-IPB3K.tmp","sha256":"6c03e9746fd05b473619d60ef71d9b56a5451bb4acac507fe17fce3d6505291f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-M7JQD.tmp","sha256":"b64e447e4feffdd12fca800a20743bc95ee7d5aa0045165d96e2aabb8f74be4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-MBMU1.tmp","sha256":"b889fb874f7585a07cf38eade6c41db5a77d769c5bbcf374ffaca6956de07d5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-PJL1F.tmp","sha256":"b42d3f00286d3886275bc368ef7096a0c5e4c30bc88b7ebdbab38393776be0bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"is-QCKT9.tmp","sha256":"2ecce9538f7db2c20d9997d7349f41f7356ad8266bb3ad5ba61cc3a85f3098ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]}],"files_written":[{"path":"C:\\Patch.exe","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%WINDIR%\\SysWOW64\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%WINDIR%\\syswow64\\en\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Nero\\Nero 2021\\Nero Vision\\AdvrCntrProxy.dll","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Nero\\Nero 2021\\Nero Vision\\ExpressUI.dll","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Nero\\Nero 2021\\Nero Vision\\NMTvWizard.exe","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Nero\\Nero Common\\AdvrCntr6\\AdvrCntr6.dll","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Nero\\Nero Common\\NeroLauncher.exe","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Nero\\Nero 2021\\Nero Vision\\AMC.dll","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Nero","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Nero\\Nero Common\\web","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%WINDIR%\\syswow64\\en\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%WINDIR%\\SysWOW64\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%TEMP%\\is-OJ4RO.tmp\\1.exe","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"path":"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Nero\\Nero 2021","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Nero\\Nero 2021\\Nero Vision","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Nero\\Nero Common","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Nero\\Nero Common\\AdvrCntr6","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Nero\\Nero Common\\web\\javascripts","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"}]},{"path":"%PROGRAMFILES%\\Nero\\Nero 2021\\Nero Vision\\is-D13Q8.tmp","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"path":"%PROGRAMFILES%\\Nero\\Nero 2021\\Nero Vision\\is-UQ667.tmp","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"path":"%PROGRAMFILES%\\Nero\\Nero 2021\\Nero Vision\\is-7EPRT.tmp","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"path":"%PROGRAMFILES%\\Nero\\Nero Common\\web\\is-3JK0J.tmp","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"path":"%PROGRAMFILES%\\Nero\\Nero Common\\web\\is-IPB3K.tmp","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"path":"%PROGRAMFILES%\\Nero\\Nero Common\\web\\is-PJL1F.tmp","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"path":"%PROGRAMFILES%\\Nero\\Nero Common\\web\\is-1T5Q1.tmp","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5f874caf5a149f2d7308c3e1"},{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"63b202a47e8b781d122e3244"}]}]}},"report_ids":{"sandbox_job_ids":["63b202a47e8b781d122e3244","5f874caf5a149f2d7308c3e1"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample d05cdbdad762… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample d05cdbdad762…. Threat score 0/100. 0/28 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0"}],["$","meta","4",{"property":"og:title","content":"Sample d05cdbdad762… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample d05cdbdad762…. Threat score 0/100. 0/28 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d05cdbdad762b54398e37ec16bd11c8d057d0bb233aa6909cb73c3c790606cc0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample d05cdbdad762… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample d05cdbdad762…. Threat score 0/100. 0/28 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3c","11",{}]]